matterbridge-lg-thinq-plugin 0.1.0

package/dist/platform/thinq/thinqDeviceDiscovery.js

@@ -0,0 +1,33 @@
+export class ThinqDeviceDiscovery {
+    deviceService;
+    logger;
+    constructor(deviceService, logger) {
+        this.deviceService = deviceService;
+        this.logger = logger;
+    }
+    async discoverDevices() {
+        const devices = await this.deviceService.discoverDevices();
+        this.logger.debug(`ThinQ discoverDevices: ${devices.length} raw device(s) returned before filtering`);
+        const supported = [];
+        for (const device of devices) {
+            const resolved = this.dispatch(device);
+            if (resolved) {
+                supported.push(resolved);
+                continue;
+            }
+            this.logger.info(`ThinQ device type not supported, skipping: ${device.type} (${device.id})`);
+        }
+        this.logger.debug(`ThinQ discoverDevices: ${supported.length} device(s) supported after filtering`);
+        return supported;
+    }
+    dispatch(device) {
+        switch (device.type) {
+            case 'AC':
+                return { ...device, type: 'AC' };
+            case 'WASHER':
+                return { ...device, type: 'WASHER' };
+            default:
+                return undefined;
+        }
+    }
+}

package/dist/platform/thinq/thinqWasherCommandHandlers.js

@@ -0,0 +1,54 @@
+import { LaundryWasherMode, OnOff, OperationalState } from 'matterbridge/matter/clusters';
+const READ_ONLY_WASHER_COMMANDS = ['on', 'off', 'pause', 'start', 'resume', 'changeToMode'];
+const ON_OFF_COMMANDS = new Set(['on', 'off']);
+function revertOnOffOnFailure(washer, oldValue) {
+    washer.updateAttribute(OnOff.id, 'onOff', oldValue, washer.log).catch(() => {
+    });
+}
+function revertOperationalStateOnFailure(washer, oldOperationalState, command, oldCurrentMode) {
+    washer.updateAttribute(OperationalState.id, 'operationalState', oldOperationalState, washer.log).catch(() => {
+    });
+    if (command === 'changeToMode') {
+        washer.updateAttribute(LaundryWasherMode.id, 'currentMode', oldCurrentMode, washer.log).catch(() => {
+        });
+    }
+}
+export function registerWasherCommandHandlers(washer, device, apiClient, logger, washerControl, stopCommandPayload) {
+    for (const command of READ_ONLY_WASHER_COMMANDS) {
+        washer.addCommandHandler(command, async () => {
+            logger.warn(`ThinQ Washer remote control ('${command}') is not supported yet (deviceId=${device.id})`);
+            if (ON_OFF_COMMANDS.has(command)) {
+                const previousOnOff = washer.getAttribute(OnOff.id, 'onOff');
+                revertOnOffOnFailure(washer, previousOnOff ?? false);
+            }
+            else {
+                const previousOperationalState = washer.getAttribute(OperationalState.id, 'operationalState');
+                const previousCurrentMode = washer.getAttribute(LaundryWasherMode.id, 'currentMode');
+                revertOperationalStateOnFailure(washer, previousOperationalState ?? OperationalState.OperationalStateEnum.Stopped, command, previousCurrentMode ?? 0);
+            }
+            throw new Error(`ThinQ Washer remote control ('${command}') is not supported yet`);
+        });
+    }
+    washer.addCommandHandler('stop', async () => {
+        if (!washerControl.allowRemoteStop) {
+            logger.warn(`ThinQ Washer remote control ('stop') is disabled by configuration (deviceId=${device.id})`);
+            throw new Error(`ThinQ Washer remote control ('stop') is disabled by configuration.`);
+        }
+        if (!stopCommandPayload) {
+            logger.warn(`ThinQ Washer remote control ('stop') is not available for this device model yet (deviceId=${device.id})`);
+            throw new Error(`ThinQ Washer remote control ('stop') is not available for this device model yet.`);
+        }
+        const previousState = washer.getAttribute(OperationalState.id, 'operationalState');
+        try {
+            await apiClient.sendCommand(device.id, { ctrlKey: 'WMControl', ...stopCommandPayload });
+        }
+        catch (error) {
+            logger.error(`ThinQ Washer command 'stop' failed: ${error instanceof Error ? error.message : String(error)} (deviceId=${device.id})`);
+            washer
+                .updateAttribute(OperationalState.id, 'operationalState', previousState ?? OperationalState.OperationalStateEnum.Stopped, washer.log)
+                .catch(() => {
+            });
+            throw error;
+        }
+    });
+}

package/dist/platform/thinq/thinqWasherEndpointFactory.js

@@ -0,0 +1,6 @@
+import { LaundryWasher } from 'matterbridge/devices';
+export function buildWasherEndpoint(device, options) {
+    const washer = new LaundryWasher(device.name, device.id);
+    washer.createDefaultBasicInformationClusterServer(device.name, device.id, options?.vendorId ?? 0xfff1, options?.vendorName ?? 'Matterbridge', options?.productId ?? 0x8000, options?.productName ?? 'Matterbridge Laundry Washer');
+    return washer;
+}

package/dist/platform/thinq/thinqWasherStateSync.js

@@ -0,0 +1,31 @@
+import { OnOff, OperationalState } from 'matterbridge/matter/clusters';
+export function mapWasherStateToOperationalState(snapshot) {
+    if (snapshot.isWasherError) {
+        return OperationalState.OperationalStateEnum.Error;
+    }
+    if (snapshot.isWasherRunning) {
+        return OperationalState.OperationalStateEnum.Running;
+    }
+    if (snapshot.washerRawState === 'PAUSE') {
+        return OperationalState.OperationalStateEnum.Paused;
+    }
+    return OperationalState.OperationalStateEnum.Stopped;
+}
+export async function applyThinqSnapshotToWasher(washer, snapshot, logger) {
+    const deviceId = washer.serialNumber ?? washer.uniqueId ?? 'unknown';
+    if (snapshot.washerRawState === undefined) {
+        logger.debug(`applyThinqSnapshotToWasher: skipped (source key absent): washerDryer.state, deviceId=${deviceId}`);
+        return;
+    }
+    logger.debug(`applyThinqSnapshotToWasher: entry for deviceId=${deviceId}`);
+    await washer.updateAttribute(OnOff.id, 'onOff', snapshot.isWasherPowerOn, logger);
+    await washer.updateAttribute(OperationalState.id, 'operationalState', mapWasherStateToOperationalState(snapshot), logger);
+    await washer.updateAttribute(OperationalState.id, 'operationalError', {
+        errorStateId: snapshot.isWasherError
+            ? OperationalState.ErrorState.UnableToCompleteOperation
+            : OperationalState.ErrorState.NoError,
+    }, logger);
+    if (snapshot.washerRemainingDurationSeconds !== undefined) {
+        await washer.updateAttribute(OperationalState.id, 'countdownTime', snapshot.washerRemainingDurationSeconds, logger);
+    }
+}

package/dist/platform/thinq/thinqWasherStopCommandResolver.js

@@ -0,0 +1,38 @@
+function isRecord(value) {
+    return typeof value === 'object' && value !== null;
+}
+function toWasherStopCommandPayload(entry) {
+    const payload = {};
+    if (typeof entry.command === 'string') {
+        payload.command = entry.command;
+    }
+    if (typeof entry.dataKey === 'string') {
+        payload.dataKey = entry.dataKey;
+    }
+    if ('dataValue' in entry) {
+        payload.dataValue = entry.dataValue;
+    }
+    if (isRecord(entry.dataSetList)) {
+        payload.dataSetList = entry.dataSetList;
+    }
+    else if (isRecord(entry.data)) {
+        payload.dataSetList = entry.data;
+    }
+    return payload;
+}
+export function extractWasherStopCommand(deviceModel) {
+    if (!isRecord(deviceModel)) {
+        return undefined;
+    }
+    const controlWifi = deviceModel.ControlWifi;
+    if (!isRecord(controlWifi)) {
+        return undefined;
+    }
+    const stopEntry = isRecord(controlWifi.WMStop) ? controlWifi.WMStop : undefined;
+    const offEntry = isRecord(controlWifi.WMOff) ? controlWifi.WMOff : undefined;
+    const entry = stopEntry ?? offEntry;
+    if (!entry) {
+        return undefined;
+    }
+    return toWasherStopCommandPayload(entry);
+}

package/dist/services/authentication/AccountAuthStrategy.js

@@ -0,0 +1,135 @@
+import crypto from 'node:crypto';
+import axios from 'axios';
+import { AuthenticationError, InvalidCredentialsError } from '../../errors/index.js';
+import { buildEmpDefaultHeaders, formatRfc2822Utc, Gateway, signThinqMessage, THINQ_CLIENT_ID, THINQ_OAUTH_CLIENT_KEY, THINQ_OAUTH_SECRET_KEY, } from '../thinq/gateway.js';
+import { ThinqSession } from '../thinq/session.js';
+const EMP_REDIRECT_URI = 'lgaccount.lgsmartthinq:/';
+function isClientErrorResponse(err) {
+    if (!axios.isAxiosError(err)) {
+        return false;
+    }
+    const status = err.response?.status;
+    return status !== undefined && status >= 400 && status < 500;
+}
+export class AccountAuthStrategy {
+    apiClient;
+    logger;
+    constructor(apiClient, logger) {
+        this.apiClient = apiClient;
+        this.logger = logger;
+    }
+    async authenticate(context) {
+        if (!context.username || !context.password) {
+            throw new InvalidCredentialsError(context.username);
+        }
+        this.logger.notice('Authenticating with LG ThinQ account credentials...');
+        const gatewayData = await this.apiClient.getGateway();
+        const gateway = new Gateway(gatewayData);
+        const hashedPassword = crypto.createHash('sha512').update(context.password).digest('hex');
+        return this.loginStep2(gateway, context.username, hashedPassword, context.country, context.language);
+    }
+    async loginStep2(gateway, username, encryptedPassword, country, language) {
+        const headers = { ...buildEmpDefaultHeaders(gateway) };
+        const preLoginData = new URLSearchParams({
+            user_auth2: encryptedPassword,
+            log_param: `login request / user_id : ${username} / third_party : null / svc_list : SVC202,SVC710 / 3rd_service : `,
+        });
+        const preLogin = await axios
+            .post(`${gateway.loginBaseUrl}preLogin`, preLoginData.toString(), { headers })
+            .then((res) => res.data)
+            .catch((err) => {
+            if (isClientErrorResponse(err)) {
+                throw new InvalidCredentialsError(username);
+            }
+            throw new AuthenticationError('LG pre-login failed.', { cause: err });
+        });
+        headers['X-Signature'] = preLogin.signature;
+        headers['X-Timestamp'] = preLogin.tStamp;
+        const sessionData = new URLSearchParams({
+            user_auth2: preLogin.encrypted_pw,
+            password_hash_prameter_flag: 'Y',
+            svc_list: 'SVC202,SVC710',
+        });
+        const loginUrl = `${gateway.empBaseUrl}emp/v2.0/account/session/${encodeURIComponent(username)}`;
+        const account = await axios
+            .post(loginUrl, sessionData.toString(), { headers })
+            .then((res) => res.data.account)
+            .catch((err) => {
+            if (isClientErrorResponse(err)) {
+                throw new InvalidCredentialsError(username);
+            }
+            throw new AuthenticationError('LG account login failed.', { cause: err });
+        });
+        const secretKeyUrl = `${gateway.loginBaseUrl}searchKey?key_name=OAUTH_SECRETKEY&sever_type=OP`;
+        const secretKey = await axios
+            .get(secretKeyUrl)
+            .then((res) => res.data.returnData)
+            .catch((err) => {
+            throw new AuthenticationError('LG OAuth key lookup failed.', { cause: err });
+        });
+        const timestamp = formatRfc2822Utc(new Date());
+        const empParams = new URLSearchParams({
+            account_type: account.userIDType,
+            client_id: THINQ_CLIENT_ID,
+            country_code: account.country,
+            redirect_uri: EMP_REDIRECT_URI,
+            response_type: 'code',
+            state: '12345',
+            username: account.userID,
+        });
+        const empUrl = new URL(`https://emp-oauth.lgecloud.com/emp/oauth2/authorize/empsession?${empParams.toString()}`);
+        const empSignature = signThinqMessage(`${empUrl.pathname}${empUrl.search}\n${timestamp}`, secretKey);
+        const authorize = await axios
+            .get(empUrl.href, {
+            headers: {
+                'lgemp-x-app-key': THINQ_OAUTH_CLIENT_KEY,
+                'lgemp-x-date': timestamp,
+                'lgemp-x-session-key': account.loginSessionID,
+                'lgemp-x-signature': empSignature,
+                Accept: 'application/json',
+                'X-Device-Type': 'M01',
+                'X-Device-Platform': 'ADR',
+                'Content-Type': 'application/x-www-form-urlencoded',
+            },
+        })
+            .then((res) => res.data)
+            .catch((err) => {
+            throw new AuthenticationError('LG OAuth authorization failed.', { cause: err });
+        });
+        if (authorize.status !== 1) {
+            throw new AuthenticationError(authorize.message ?? 'LG OAuth authorization was rejected.');
+        }
+        const redirectUri = new URL(authorize.redirect_uri);
+        const code = redirectUri.searchParams.get('code') ?? '';
+        const oauth2BackendUrl = redirectUri.searchParams.get('oauth2_backend_url') ?? gateway.loginBaseUrl;
+        const tokenData = new URLSearchParams({
+            code,
+            grant_type: 'authorization_code',
+            redirect_uri: EMP_REDIRECT_URI,
+        });
+        const requestPath = `/oauth/1.0/oauth2/token?${tokenData.toString()}`;
+        const tokenTimestamp = formatRfc2822Utc(new Date());
+        const token = await axios
+            .post(`${oauth2BackendUrl}oauth/1.0/oauth2/token`, tokenData.toString(), {
+            headers: {
+                'x-lge-app-os': 'ADR',
+                'x-lge-appkey': THINQ_CLIENT_ID,
+                'x-lge-oauth-signature': signThinqMessage(`${requestPath}\n${tokenTimestamp}`, THINQ_OAUTH_SECRET_KEY),
+                'x-lge-oauth-date': tokenTimestamp,
+                Accept: 'application/json',
+                'Content-Type': 'application/x-www-form-urlencoded',
+            },
+        })
+            .then((res) => res.data)
+            .catch((err) => {
+            throw new AuthenticationError('LG token exchange failed.', { cause: err });
+        });
+        return {
+            accessToken: token.access_token,
+            refreshToken: token.refresh_token,
+            expiresAtEpochSeconds: ThinqSession.expiryFromExpiresIn(Number.parseInt(token.expires_in, 10)),
+            country,
+            language,
+        };
+    }
+}

package/dist/services/authentication/AuthContext.js

@@ -0,0 +1 @@
+export {};

package/dist/services/authentication/AuthenticationCoordinator.js

@@ -0,0 +1,29 @@
+export class AuthenticationCoordinator {
+    apiClient;
+    logger;
+    strategies;
+    constructor(accountStrategy, tokenStrategy, apiClient, logger) {
+        this.apiClient = apiClient;
+        this.logger = logger;
+        this.strategies = new Map([
+            ['account', accountStrategy],
+            ['token', tokenStrategy],
+        ]);
+    }
+    async authenticate(method, context) {
+        const strategy = this.strategies.get(method);
+        if (!strategy) {
+            const availableMethods = Array.from(this.strategies.keys()).join(', ');
+            this.logger.error(`Unknown ThinQ authentication method: ${method}. Available methods: ${availableMethods}`);
+            throw new Error(`Unknown ThinQ authentication method: ${method}`);
+        }
+        const userData = await strategy.authenticate(context);
+        if (!userData) {
+            return userData;
+        }
+        this.logger.debug('AuthenticationCoordinator: resolving ThinQ user number post-login');
+        const userNumber = await this.apiClient.getUserNumber(userData.accessToken);
+        this.apiClient.setUserNumber(userNumber);
+        return { ...userData, userNumber };
+    }
+}

package/dist/services/authentication/IAuthStrategy.js

@@ -0,0 +1 @@
+export {};

package/dist/services/authentication/TokenAuthStrategy.js

@@ -0,0 +1,27 @@
+import { AuthenticationError } from '../../errors/index.js';
+import { ThinqSession } from '../thinq/session.js';
+export class TokenAuthStrategy {
+    apiClient;
+    logger;
+    constructor(apiClient, logger) {
+        this.apiClient = apiClient;
+        this.logger = logger;
+    }
+    async authenticate(context) {
+        if (!context.refreshToken) {
+            throw new AuthenticationError('A ThinQ refresh token is required for token-based authentication.');
+        }
+        this.logger.notice('Authenticating with LG ThinQ refresh token...');
+        this.logger.debug('TokenAuthStrategy: resolving gateway before refresh-token exchange');
+        await this.apiClient.getGateway();
+        const session = new ThinqSession('', context.refreshToken, 0);
+        const refreshed = await this.apiClient.refreshToken(session);
+        return {
+            accessToken: refreshed.accessToken,
+            refreshToken: refreshed.refreshToken,
+            expiresAtEpochSeconds: refreshed.expiresAtEpochSeconds,
+            country: context.country,
+            language: context.language,
+        };
+    }
+}

package/dist/services/authentication/UserDataRepository.js

@@ -0,0 +1,32 @@
+const STORAGE_KEY = 'thinq:userData';
+export class UserDataRepository {
+    persist;
+    configManager;
+    logger;
+    constructor(persist, configManager, logger) {
+        this.persist = persist;
+        this.configManager = configManager;
+        this.logger = logger;
+    }
+    async loadUserData() {
+        const savedUserData = (await this.persist.getItem(STORAGE_KEY));
+        if (!savedUserData) {
+            this.logger.debug('No saved ThinQ userData found');
+            return undefined;
+        }
+        if (savedUserData.country !== this.configManager.country) {
+            this.logger.debug('Saved ThinQ userData country does not match current config, ignoring saved data');
+            await this.clearUserData();
+            return undefined;
+        }
+        this.logger.debug('Loading saved ThinQ userData');
+        return savedUserData;
+    }
+    async saveUserData(userData) {
+        await this.persist.setItem(STORAGE_KEY, userData);
+        this.logger.debug('ThinQ user data saved successfully');
+    }
+    async clearUserData() {
+        await this.persist.removeItem(STORAGE_KEY);
+    }
+}

package/dist/services/thinq/gateway.js

@@ -0,0 +1,61 @@
+import crypto from 'node:crypto';
+export const THINQ_CLIENT_ID = 'LGAO221A02';
+export const THINQ_OAUTH_SECRET_KEY = 'c053c2a6ddeb7ad97cb0eed0dcb31cf8';
+export const THINQ_OAUTH_CLIENT_KEY = 'LGAO722A02';
+export const THINQ_APPLICATION_KEY = '6V1V8H2BN5P9ZQGOI5DAQ92YZBDO3EK9';
+export class Gateway {
+    data;
+    constructor(data) {
+        this.data = data;
+    }
+    get empBaseUrl() {
+        return `${this.data.empTermsUri}/`;
+    }
+    get loginBaseUrl() {
+        return `${this.data.empSpxUri}/`;
+    }
+    get thinq2Url() {
+        return `${this.data.thinq2Uri}/`;
+    }
+    get thinq1Url() {
+        return `${this.data.thinq1Uri}/`;
+    }
+    get countryCode() {
+        return this.data.countryCode;
+    }
+    get languageCode() {
+        return this.data.languageCode;
+    }
+}
+export function signThinqMessage(message, secret) {
+    return crypto.createHmac('sha1', Buffer.from(secret)).update(message).digest('base64');
+}
+const RFC2822_DAYS = ['Sun', 'Mon', 'Tue', 'Wed', 'Thu', 'Fri', 'Sat'];
+const RFC2822_MONTHS = ['Jan', 'Feb', 'Mar', 'Apr', 'May', 'Jun', 'Jul', 'Aug', 'Sep', 'Oct', 'Nov', 'Dec'];
+export function formatRfc2822Utc(date) {
+    const day = RFC2822_DAYS[date.getUTCDay()];
+    const dd = String(date.getUTCDate()).padStart(2, '0');
+    const month = RFC2822_MONTHS[date.getUTCMonth()];
+    const hh = String(date.getUTCHours()).padStart(2, '0');
+    const mi = String(date.getUTCMinutes()).padStart(2, '0');
+    const ss = String(date.getUTCSeconds()).padStart(2, '0');
+    return `${day}, ${dd} ${month} ${date.getUTCFullYear()} ${hh}:${mi}:${ss} +0000`;
+}
+export function buildEmpDefaultHeaders(gateway) {
+    return {
+        Accept: 'application/json',
+        'X-Application-Key': THINQ_APPLICATION_KEY,
+        'X-Client-App-Key': THINQ_CLIENT_ID,
+        'X-Lge-Svccode': 'SVC709',
+        'X-Device-Type': 'M01',
+        'X-Device-Platform': 'ADR',
+        'X-Device-Language-Type': 'IETF',
+        'X-Device-Publish-Flag': 'Y',
+        'X-Device-Country': gateway.countryCode,
+        'X-Device-Language': gateway.languageCode,
+        'Content-Type': 'application/x-www-form-urlencoded;charset=UTF-8',
+        'Access-Control-Allow-Origin': '*',
+        'Accept-Encoding': 'gzip, deflate, br',
+        'Accept-Language': 'en-US,en;q=0.9',
+    };
+}

package/dist/services/thinq/mqtt/mqttCertificate.js

@@ -0,0 +1,63 @@
+import FS from 'node:fs';
+import Path from 'node:path';
+import axios from 'axios';
+import forge from 'node-forge';
+export const ATS_ROOT_CA_URL = 'https://www.amazontrust.com/repository/AmazonRootCA1.pem';
+export const LG_ROOT_CA_URL = 'https://support.sectigo.com/sfc/servlet.shepherd/version/download/0683l00000G9fLm';
+export const LEGACY_ROOT_CA_URL = 'https://www.websecurity.digicert.com/content/dam/websitesecurity/digitalassets/desktop/pdfs/roots/' +
+    'VeriSign-Class%203-Public-Primary-Certification-Authority-G5.pem';
+export function generateMqttKeyPair() {
+    const keys = forge.pki.rsa.generateKeyPair(2048);
+    return {
+        privateKey: forge.pki.privateKeyToPem(keys.privateKey),
+        publicKey: forge.pki.publicKeyToPem(keys.publicKey),
+    };
+}
+export function createMqttCsr(keys) {
+    const csr = forge.pki.createCertificationRequest();
+    csr.publicKey = forge.pki.publicKeyFromPem(keys.publicKey);
+    csr.setSubject([
+        { shortName: 'CN', value: 'AWS IoT Certificate' },
+        { shortName: 'O', value: 'Amazon' },
+    ]);
+    csr.sign(forge.pki.privateKeyFromPem(keys.privateKey), forge.md.sha256.create());
+    return forge.pki.certificationRequestToPem(csr);
+}
+export function certificateRequestBody(csr) {
+    return csr.replace(/-----(BEGIN|END) CERTIFICATE REQUEST-----/g, '').replace(/(\r\n|\r|\n)/g, '');
+}
+export function rootCaUrlForMqttHost(hostname) {
+    if (/^([^.]+)-ats\.iot\.([^.]+)\.amazonaws\.com$/g.exec(hostname)) {
+        return ATS_ROOT_CA_URL;
+    }
+    if (/^([^.]+)\.iot\.ruic\.lgthinq\.com$/g.exec(hostname)) {
+        return LG_ROOT_CA_URL;
+    }
+    return LEGACY_ROOT_CA_URL;
+}
+export async function downloadRootCa(hostname) {
+    const response = await axios.get(rootCaUrlForMqttHost(hostname), { responseType: 'text' });
+    return response.data;
+}
+export function mqttCertificatePaths(mqttDir) {
+    return {
+        caPath: Path.join(mqttDir, 'ca.pem'),
+        keyPath: Path.join(mqttDir, 'key.pem'),
+        certPath: Path.join(mqttDir, 'cert.pem'),
+    };
+}
+export async function writeIfChanged(path, content) {
+    const existing = await FS.promises.readFile(path, 'utf8').catch(() => null);
+    if (existing !== content) {
+        await FS.promises.writeFile(path, content, 'utf8');
+    }
+}
+export async function writeMqttCertificateFiles(options) {
+    const { mqttDir, rootCA, privateKey, certificatePem } = options;
+    await FS.promises.mkdir(mqttDir, { recursive: true });
+    const paths = mqttCertificatePaths(mqttDir);
+    await writeIfChanged(paths.caPath, rootCA);
+    await writeIfChanged(paths.keyPath, privateKey);
+    await writeIfChanged(paths.certPath, certificatePem);
+    return paths;
+}

package/dist/services/thinq/mqtt/mqttConnectionEvents.js

@@ -0,0 +1,37 @@
+export const MQTT_OFFLINE_RECONNECT_DELAY_MS = 60000;
+export function wireMqttDeviceEvents(options) {
+    const { device, logger, mqttServer, subscriptions, onMessage, reconnect, scheduleReconnect = (handler, delayMs) => setTimeout(handler, delayMs), } = options;
+    device.on('error', (err) => {
+        logger.error('mqtt err:', err);
+    });
+    device.on('connect', () => {
+        logger.info('Successfully connected to the MQTT server.');
+        logger.debug('mqtt connected:', mqttServer);
+        for (const subscription of subscriptions) {
+            device.subscribe(subscription);
+        }
+    });
+    device.on('message', (_topic, payload) => {
+        const payloadText = payload.toString();
+        let parsedPayload;
+        try {
+            parsedPayload = JSON.parse(payloadText);
+        }
+        catch (err) {
+            logger.error('mqtt message parse error:', err);
+            logger.debug('mqtt invalid message received:', payloadText);
+            return;
+        }
+        onMessage(parsedPayload);
+        logger.debug('mqtt message received:', payloadText);
+    });
+    device.on('offline', () => {
+        device.end();
+        logger.info('MQTT disconnected, retrying in 60 seconds!');
+        scheduleReconnect(() => {
+            reconnect().catch((err) => {
+                logger.error('mqtt reconnect failed:', err);
+            });
+        }, MQTT_OFFLINE_RECONNECT_DELAY_MS);
+    });
+}

package/dist/services/thinq/mqtt/mqttKeyRepository.js

@@ -0,0 +1,33 @@
+import { createMqttCsr, generateMqttKeyPair } from './mqttCertificate.js';
+const KEY_PAIR_STORAGE_KEY = 'thinq:mqtt:keyPair';
+const CSR_STORAGE_KEY = 'thinq:mqtt:csr';
+export class MqttKeyRepository {
+    persist;
+    logger;
+    constructor(persist, logger) {
+        this.persist = persist;
+        this.logger = logger;
+    }
+    async getOrCreateKeyPair() {
+        const cached = (await this.persist.getItem(KEY_PAIR_STORAGE_KEY));
+        if (cached) {
+            this.logger.debug('Loaded cached MQTT key pair');
+            return cached;
+        }
+        this.logger.debug('Generating 2048-bit MQTT key pair...');
+        const keys = generateMqttKeyPair();
+        await this.persist.setItem(KEY_PAIR_STORAGE_KEY, keys);
+        return keys;
+    }
+    async getOrCreateCsr(keys) {
+        const cached = (await this.persist.getItem(CSR_STORAGE_KEY));
+        if (cached) {
+            this.logger.debug('Loaded cached MQTT CSR');
+            return cached;
+        }
+        this.logger.debug('Creating MQTT certification request (CSR)...');
+        const csr = createMqttCsr(keys);
+        await this.persist.setItem(CSR_STORAGE_KEY, csr);
+        return csr;
+    }
+}

package/dist/services/thinq/mqtt/mqttRetry.js

@@ -0,0 +1,25 @@
+export const MQTT_RETRY_ATTEMPTS = 5;
+export const MQTT_RETRY_DELAY_MS = 5000;
+export function delayMs(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+export async function retryMqttRegistration(options) {
+    const { register, logger, delay = delayMs, attempts = MQTT_RETRY_ATTEMPTS, retryDelayMs = MQTT_RETRY_DELAY_MS, } = options;
+    let tried = attempts;
+    while (tried > 0) {
+        try {
+            await register();
+            return true;
+        }
+        catch (err) {
+            tried--;
+            logger.debug(`mqtt err: ${err instanceof Error ? err.message : String(err)}`);
+            if (tried > 0) {
+                logger.debug('Cannot start MQTT, retrying in 5s.');
+                await delay(retryDelayMs);
+            }
+        }
+    }
+    logger.error('Cannot start MQTT!');
+    return false;
+}